The checkFieldAccess method in the core's entity access control handler can be overridden to control access to specific entity fields when modifying an entity. Without being overridden by a child class, the \Drupal\Core\Entity\EntityAccessControlHandler::checkFieldAccess will always return an allowed access result. The method receives the following parameters:

• The view and edit operations
• The current field's definition
• The user session to check access against
• A possible list of field item values

Entity types can implement their own access control handlers and override this method to provide granular control over the modification of their base fields. A good example would be the User module and its \Drupal\user\UserAccessControlHandler.

User entities have a pass field that is used for the user's current password. There is also a created field that records when the user was added to the site.

For the pass field, it returns denied if the operation is view, but allows access if the operation is edit:

case 'pass': 
  // Allow editing the password, but not viewing it. 
  return ($operation == 'edit') ? AccessResult::allowed() : AccessResult::forbidden(); 

The created field uses the opposite logic. When a user logs in, the site can be viewed but cannot be edited:

case 'created': 
  // Allow viewing the created date, but not editing it. 
  return ($operation == 'view') ? AccessResult::allowed() : AccessResult::forbidden();